ffbfda2b701f97bc5124e626234c848564185f6133ffaf007d87b94b99360c62

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 00:12

Target
crypted.exe
Size 11.1MB
Sample260814-ahmwcaeb95
SHA256 ffbfda2b701f97bc5124e626234c848564185f6133ffaf007d87b94b99360c62
MD5 4914c844e5d94672827bb63f7c4fd19e
SHA1 5f0c52881f0e6dc9789c5c7a563b348428074428
SHA512 9b4c937315cb1c02b6fb5529f1fba5d99faf2de969fb404069992574bbe0e061dfe69efcfb7085dc7dcbf83f921a97e2e26b7d771f0df14f4095348876915aeb
SSDEEP 24576:m3cszoA9pP1y27ZXYCRkJmVq2PLiNdssBq0vL4KZceRVlQ:m3cszdnYCwmsaiNdsaj4KZcey
TLSH
T1B1C66A17AFDC13FCE627C3FC8A959232E2F174410761AADB1655D7193E23AE06E3A211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4528	4872	crypted.exe	89
PID 4872 wrote to memory of 4528	4872	crypted.exe	89

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:4528

memory/4872-0-0x0000000000580000-0x0000000000581000-memory.dmp

Download